Bug 1792512 (CVE-2019-19922)

Summary:	CVE-2019-19922 kernel: when cpu.cfs_quota_us is used allows attackers to cause a denial of service against non-cpu-bound applications
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	acaringi, airlied, bhu, blc, brdeoliv, bskeggs, dhoward, dvlasenk, esammons, fhrbata, hdegoede, hkrzesin, iboverma, ichavero, itamar, jarodwilson, jeremy, jforbes, jglisse, jlelli, john.j5live, jonathan, josef, jross, jshortt, jstancek, jwboyer, kernel-maint, kernel-mgr, labbott, lgoncalv, linville, masami256, matt, mchehab, mcressma, mjg59, mlangsdo, nmurray, qzhao, rt-maint, rvrbovsk, steved, williams, wmealing
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the Linux kernel’s scheduler, where it can allow attackers to cause a denial of service against non-CPU-bound applications by generating a workload that triggers unwanted scheduling slice expiration. A local attacker who can trigger a specific workload type could abuse this technique to trigger a system to be seen as degraded, and possibly trigger workload-rebalance in systems that use the slice-expiration metric as a measure of system health.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-04-16 16:32:14 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1890034, 1706247, 1792513, 1806793, 1806794, 1806795, 1810452
Bug Blocks:	1792514

Description Guilherme de Almeida Suckevicz 2020-01-17 19:16:55 UTC

A flaw was found in the Linux kernels scheduler which can allow attackers to cause a denial of service against non-CPU-bound applications by generating a workload that triggers unwanted scheduling slice expiration.  A local attacker who is able to trigger a specific workload type could abuse this technique to trigger a system to be seen as 'degraded' and possibly trigger workload-rebalance in systems that use slice-expiration metric as a measure of system health.

Reference:
https://github.com/kubernetes/kubernetes/issues/67577

Reference and upstream commit:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=de53fd7aedb100f03e5d2231cfce0e4993282425

Comment 1 Guilherme de Almeida Suckevicz 2020-01-17 19:17:50 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1792513]

Comment 2 Justin M. Forbes 2020-01-20 18:41:26 UTC

This was fixed for Fedora with the 5.3.9 stable kernel update.

Comment 9 Petr Matousek 2020-03-06 12:36:45 UTC

Mitigation:

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Comment 10 errata-xmlrpc 2020-04-16 14:38:52 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:1493 https://access.redhat.com/errata/RHSA-2020:1493

Comment 11 Product Security DevOps Team 2020-04-16 16:32:14 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-19922

Comment 12 errata-xmlrpc 2020-04-28 15:25:24 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:1567 https://access.redhat.com/errata/RHSA-2020:1567

Comment 13 errata-xmlrpc 2020-04-28 15:52:00 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:1769 https://access.redhat.com/errata/RHSA-2020:1769